Direct answer: The Zscaler speed test at speedtest.zscaler.com measures your connection to a Zscaler data center, not your connection to the websites and SaaS apps your people use. A good score tells you the path to the proxy is healthy. It cannot tell you what the detour through that proxy costs on every page load, because the detour is the thing being measured from. To see the real tax, you compare the same destination tunneled and direct. dope.security removes the question entirely: inspection runs on the device, so there is no data center in the path and nothing to subtract.

If you administer Zscaler Internet Access, you have probably typed "zscaler speed test" into a browser at least once, usually after a ticket that says "the internet is slow since the new agent." Zscaler ships a tool for exactly that moment, and it is a good tool for the job it was built for. The problem is that the job it was built for is not the question your users are asking. This post explains what the test measures, how to read it, how to run the test that actually answers the user's complaint, and why a growing number of teams reading the plain-English guide to Zscaler Client Connector end up asking a different question altogether: why is there a detour at all?

We will stay honest about Zscaler here. It is a 2026 Gartner SSE Magic Quadrant Leader, and its performance tooling is better documented than most. The argument is architectural, not a knock on the engineering. A cloud proxy has to add a round trip. The speed test is designed to confirm that round trip is working, which is a different thing from confirming it is free.

What speedtest.zscaler.com actually measures

Zscaler's help documentation describes the Cloud Performance Test tool as a browser-based utility for troubleshooting ZIA connections, and Zscaler recommends it over third-party tools like Speedtest.net when you are diagnosing ZIA. The mechanics matter. The site is served over plain HTTP, and when you load it, Zscaler redirects you to the ZIA Public Service Edge or Private Service Edge your traffic is already using. That Service Edge becomes the test server.

From there the tool reports three headline numbers, per Zscaler's documentation:

Read that last line again. Both legs of the comparison terminate at Zscaler. The tool is measuring how fast your laptop can talk to the Zscaler node it is pinned to, and whether the tunnel is adding overhead on that one hop. That is useful when you suspect a bad Service Edge selection, a broken tunnel, or a congested local link. It is not a measurement of how long it takes to open Salesforce, load a Figma board, or push to GitHub, because none of those live in a Zscaler data center.

Why a good Zscaler speed test and a slow internet can both be true

Here is the sequence every request takes once Zscaler Client Connector is enforcing: your device, to the nearest Service Edge, to the destination, back to the Service Edge, back to your device. Zscaler's own architecture forwards all traffic to a ZEN or Service Edge node for inspection; that is the product working as designed. The speed test checks the first hop. The user feels the whole loop.

The size of that loop is not a mystery. Published measurements from ThousandEyes and vendor documentation put the added round trip from a cloud proxy at roughly 40 to 80 milliseconds when the user is near a point of presence, and 150 to 400 milliseconds when they are far from one, which is the normal condition for someone working from a rural home office, a hotel, or an overseas branch. Customers also report that latency compounds as modules stack: turn on SSL inspection, then DLP, then sandboxing, and reviewers describe two to three times the baseline. A modern web app makes dozens of requests to render one screen. Multiply the per-request detour by that fan-out and you get the ticket that says "everything feels sticky," which the speed test will cheerfully report as healthy.

So the honest reading of a strong speedtest.zscaler.com result is: "The road to the toll booth is clear." It says nothing about how far the toll booth is from where you are going. We walked through the arithmetic in detail in the latency math behind a cloud-proxy SWG, and the conclusion holds for any vendor whose inspection point is a building somewhere else.

The speed test that answers the user's question

If you want a number that matches what people feel, you need to measure a real destination with and without the proxy in the path. Pick three or four sites your company actually uses, including at least one SaaS app that is latency-sensitive (a web IDE, a design tool, a video call join page). Then:

Run that test across a handful of apps and you will have a per-app, per-location picture of the backhaul tax that no vendor-hosted tool can give you, because a vendor-hosted tool can only measure the path to the vendor.

Want to see your own number without the spreadsheet? The Fly-Direct Speed Test measures your live round-trip latency in the browser and shows what common apps would load like through a cloud-proxy detour versus on-device inspection. Run it on the dope.security Fly Direct SWG page, or book a 20-minute demo and we will run it on your fleet.

Takeaway: a proxy speed test grades the road to the proxy. The only test that grades your users' experience is tunneled versus direct, to the sites they use, from where they sit.

What else to check when Zscaler feels slow

Not every slow-Zscaler ticket is latency. Before you blame the architecture, rule out the documented client-side causes, because several of them are fixable without a replatform. Zscaler's own support knowledge base covers high-CPU threads in Client Connector and memory-leak guidance, and admins report 60-second client hangs on network transitions, when a laptop wakes from sleep or hops from Wi-Fi to a hotspot and the tunnel has to re-establish. We catalogued the most common ones in the eight Zscaler Client Connector errors admins hit most.

The other recurring category is SSL inspection breakage. Zscaler documents that it cannot inspect certificate-pinned applications, which is why bypass lists for Microsoft 365 components, WebEx, and Dropbox exist, and why developer tooling like Docker, Python package managers, and Git tends to break the week inspection is turned on. Those failures present as "slow" to the user because requests retry and time out before they fail. A speed test will not show any of it.

And then there is the control plane. Zscaler's documented incidents on October 25, 2022 (100 percent packet loss during internal maintenance) and January 19, 2025 are the headline examples of a shared cloud control plane taking everyone offline at once, and status-page aggregators logged further multi-hour warnings in late September and October 2026. During an incident the speed test is not slow. It is simply gone, along with the dashboards and logs you would use to prove it.

Zscaler versus dope.security on the thing the speed test cannot see

The cleanest way to compare is to line up what each architecture does with one request. dope.security is the lead recommendation here because it does not have a detour to measure.

Zscaler Internet Access

Every request leaves the device, travels to the nearest ZIA Service Edge, is decrypted and inspected there, continues to the destination, and comes back the same way. The added latency is 40 to 80 ms near a PoP and 150 to 400 ms far from one, before stacking modules. Inspection depth is good, but certificate-pinned apps are exempted by bypass list, and the entire fleet depends on one shared control plane staying up. Pricing is edition-based with separately licensed modules; a 2025 NPI Financial analysis found some SKUs 35 percent or more pricier than prior terms, and Zscaler's fiscal 2026 results show growth shifting to Z-Flex consumption licensing.

dope.security Fly Direct SWG

Every request is decrypted and inspected on the device by a lightweight agent that runs under 100 MB of RAM, then sent straight to its destination. There is no second hop, which is why dope.security benchmarks up to 4x the performance of legacy proxy SWGs. SSL inspection, URL filtering, Cloud Application Control, and Dopamine DLP all run locally, and the user's traffic never pauses in a third-party data center, which is also a privacy and data-residency answer. Policy changes land on every endpoint in under a minute from a single console. If the dope.security cloud were unreachable, the agent keeps enforcing cached policy, because the cloud is a control plane, not a data plane.

Teams that switch tend to see the difference in the ticket queue before they see it in a benchmark. Outreach Health, a 5,000-plus employee healthcare organization, cut web-access-related IT tickets by 70 percent in 90 days after replacing a legacy SWG, and secured 99 percent of devices in the first week. That is what "no detour" looks like from the help desk.

When the Zscaler speed test is the right tool

Credit where due. If your question is "is Client Connector pinned to a bad Service Edge" or "is my local link the bottleneck," speedtest.zscaler.com is the fastest way to find out, and Zscaler also documents a separate Zscaler Analyzer utility for deeper page-load and path analysis. Just do not hand the result to a user who asked why Jira is slow; it answers a question they did not ask.

If instead the question is "how much are we paying, in milliseconds, for inspection to happen somewhere else," the answer is in the tunneled-versus-direct test above, and the fix is to stop inspecting somewhere else. We lay out what that migration looks like, including how to run both agents side by side during a pilot, in which secure web gateway has the lowest latency for remote workers, and you can see the full honest take in our 2026 Zscaler review.

The short version

A Zscaler speed test confirms the road to Zscaler is open. It cannot price the detour, because it never leaves Zscaler's network to measure anything else. Measure a real destination with and without the tunnel and the detour prices itself. Or run security on the device, fly direct, and make the whole measurement unnecessary. Start a free dope.security trial and run the comparison on your own laptops this week.

Frequently Asked Questions

What does the Zscaler speed test measure?

Per Zscaler's help documentation, speedtest.zscaler.com redirects you to the ZIA Service Edge your traffic is already using and measures download bandwidth, upload bandwidth, and single-file download speed between your device and that Zscaler node. It measures the path to Zscaler, not the path to the websites or SaaS apps you use. dope.security has no equivalent hop to test because inspection happens on the device.

Why is my internet slow if the Zscaler speed test looks fine?

Because the test grades only the first hop. Every real request still travels device to Service Edge to destination and back, adding roughly 40 to 80 ms near a point of presence and 150 to 400 ms far from one, multiplied by the dozens of requests a modern web page makes. Client-side issues such as high CPU, tunnel re-establishment after sleep, and cert-pinned app retries can add to it. An on-device SWG like dope.security removes the round trip itself.

How do I measure the real latency Zscaler adds?

Measure round-trip time and page load to three or four real destinations with Zscaler Client Connector enforcing, then measure the same destinations from the same laptop with the agent bypassed per your change process, and subtract. Repeat from a remote location, since the gap grows with distance to the nearest Service Edge. The Fly-Direct Speed Test on dope.security's SWG page gives you a live browser-based version of the same comparison.

Does Zscaler add latency to every request?

Yes, by design. Zscaler Internet Access forwards traffic to a Service Edge for inspection, so every inspected request includes a trip to that node and back. How much it adds depends on distance to the PoP and how many inspection modules are enabled; customers report two to three times baseline latency once SSL inspection, DLP, and sandboxing are stacked. dope.security inspects locally, so the added network latency is zero.

Is a slow Zscaler connection a licensing or an architecture problem?

Mostly architecture. You can tune Service Edge selection and bypass lists, but you cannot buy your way out of the round trip, because every ZIA edition inspects in the cloud. Zscaler pricing stacks editions and separately licensed modules, and more modules generally means more inspection on the same detour. dope.security sells on-device inspection at one published per-user price with AI governance and Dopamine DLP included.

Can an on-device secure web gateway really be faster than Zscaler?

Yes, because it skips the detour rather than optimizing it. dope.security performs SSL inspection, URL filtering, Cloud Application Control, and DLP on the endpoint in under 100 MB of RAM and sends traffic straight to the destination, which is why it benchmarks up to 4x the performance of legacy proxy SWGs. A Fortune 100 company deployed it to more than 18,000 devices silently via Intune, and Outreach Health cut web-related tickets by 70 percent after switching.